Hi,We're starting to see a number of cases being raised internally about some of our Macs (all on macOS 15.1.1) having intermittent login issues.  Our devices are bound to AD and our users have been logging on fine for some time but now we're starting to get issues.  Sometimes the logins are fine.  Sometimes they take ~10 mins and sometimes they appear to stall completely (waited over 2.5 hours in testing) even on the same device.  The login screen appears to freeze (the time doesn't change) and you eventually get the spinning beachball.  SSH is still working and you can run a "jamf policy" successfully.  "Screen Sharing" reports that the user who has attempted to log into the device is the active user when you connect.Can anyone share some tips as to how we would start to investigate this sort of issue let alone resolve it???ThanksStuart

Hi everyone, I. HATE. PRINTERS. That being said, we have to work with them.  and... Canon does not make it easy. Here is what I was able to find out from several places online, in order to get this "installer" to actually work. So let's jump on to our Macs and get this over with.Downloading the "Installer"1. Log into your Uniflow Online (web)2. Start Printing (Side Bar)3. Install Printer Driver > Click [Download macOS printer driver] Navigate to Download FolderOpen SmartClientMac.iso > Open SmartClientMac Volume > Notice here you only have 1 file. But actually there are 4. 3 are hidden.On your Keyboard us the show hidden files shortcut: Command+Shift+.(Period)Getting Files in the Right LocationYou will now see 3 other files. We only need the SmartClientForMac.pkg and tenantcfg.plist files.Next, Go to Finder > Go > Go to Folder (Shift+Command+G)Enter 'private/tmp'Next create a new folder called 'uniflowclient'Which is now located in private/tmp/un

Good afternoon I have a weird issue that is coming at a horrible time!  I have 6 M1 2020 Mac Minis that are failing at retrieving enrollment profiles.  Nothing has changed in my environment, and I even just pulled 4 new M4 MacBook Airs out of the box to test.  The Minis were previously in a different lab (one that I just successfully reset 16 other computers in), but these 6 continuously fail to enroll.  Any ideas?

It is very tedious going one device at a time to see if there are failed commands. Has anyone been able to create a Search that shows devices with failed commands?

As part of Apple’s unveiling of Declarative Device Management (DDM) at WWDC 2023, Apple announced that DDM management included the ability to deploy MDM configuration profiles using DDM as the delivery mechanism in place of using MDM to deliver the profiles. Jamf Pro’s Blueprints leverages this capability to support device restrictions. Let’s see how this works using a device restriction configuration, using the example of setting the following Apple Intelligence management functions to false in order to block the corresponding Apple Intelligence functions on macOS:For more details, please see below the jump.As of Jamf Pro 11.18.0, there is not a Blueprints template available for creating blueprints which manage device restrictions so the blueprint will need to be configured manually. To do this, use the following procedure:1. Log into Jamf Pro.2. Select Blueprints3. Click the Create blueprint button.4. Give it a name when prompted and click the Create button. For this example, I’m usi

Hi everyone!I have a macOS machine running macOS 15 (Sequoia). I created a configuration profile with the “Single Sign-On Extensions” option configured with Microsoft Entra ID.This allowed me to register with Platform SSO natively on macOS, using the notification that popped up on my machine after installing the profile.However, that requires my users to manually click the notification and register. To make the process easier, I created a new configuration profile with Jamf Connect (com.jamf.connect.login), also configured with Microsoft Entra ID.Now users are able to see the Microsoft Entra ID authentication page on their login window. However, I was under the impression that once they connected at the login window, it would automatically register with Platform SSO - but it still requires them to go through that notification.Is there a way to achieve the auto-registration with the combination of the SSO extension/JAMF connect?

EnvironmentJamf School Jamf Connnect 2.45.1 macOS Tahoe (26.1, 26.2)Issue - Keychain dialog popping up for Jamf Connect on restart or fresh login.I’ve read many reports of how to fix this by updating Jamf Connect to 3.0 or higher. The issue is that JAMF School guidance is not to go past 2.45.1 for Connect menu bar reasons and lack of access to Self Service+, etc...Our goal was to move our computers from Jamf Pro to JAMF School but this lack of support has me reconsidering, with such an unclear vision how Jamf Connect will be managed in the short-term or long-term. I’m holding back our fleet from updating en mass to Tahoe just because of they keychain dialog issue, when I would like them to be there.If anyone has a solution I’m all ears for how to work with this keychain issue.  

Hello. This is my code in .net.var client = new HttpClient();var jamfUrl = "https://{server}.jamfcloud.com/";var clientId = "xxxxxxxx";var clientSecret = "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx";var byteArray = Encoding.ASCII.GetBytes($"{clientId}:{clientSecret}");client.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Basic", Convert.ToBase64String(byteArray));var response = await client.GetAsync($"{jamfUrl}/apps/");response.EnsureSuccessStatusCode();var json = await response.Content.ReadAsStringAsync();But when I execute this to get the list of applications I get following response<!doctype html><html lang="en"> <head> <meta charset="UTF-8" /> <link rel="apple-touch-icon" sizes="180x180" href="/apple-touch-icon.png" /> <link rel="icon" type="image/png" sizes="32x32" href="/favicon-32x32.png" /> <link rel="icon" type="image/png" sizes="16x16" href="/favicon-16x16.png" /> <meta name="view

Please join us on January 28th at 11AM CST for our first virtual Women in Tech JNUG quarterly meeting of 2026!  The topic for this meeting is: How to make yourself heard: carry yourself confidently and we are excited to welcome Karen Warren, Associate Vice President for Information Technology at Wesleyan University, as our guest speaker. Karen oversees the user services, technical services, and academic technology teams at Wesleyan University and is a member of the EDUCAUSE Board. Prior to coming to Wesleyan, Karen spent 15 years at the American School for the Deaf in West Hartford, CT where she was IT Director for 10 of those years. She is an experienced presenter, having spoken at the NERCOMP Annual Conference, ServiceNow Knowledge, EDUCAUSE Annual Conference and other professional workshops. Throughout her career, Karen has been committed to cultivating strong and lasting relationships to bring integrated and scalable technical solutions to the education community. We hope you can j

In our Azure logs, it shows the Jamf Pro Azure AD Connector authenticating with one of our administrator’s accounts multiple times per hour. I’ve tried looking into the documentation here: Azure AD Integration - Jamf Pro Documentation 10.43.0 | Jamf but I am wondering if this could work with a service account just to keep our user sign-in longs clean. Or if there are other best practices, I’m open to suggestions. Thanks!

I had a few devices upgrade to iOS 26 and the homescreen layout is not working….has anyone ran into an issue with this? 

So we have Google LDAP connected to Jamf. It's working great for populating User & Location information, etc. However, I'd really like to leverage 'Directory Service User Group' to scope stuff. It just doesn't seem to be working. I've tried to do some reading and I've found people saying it's unreliable. When I go to Cloud Identity Providers > Google LDAP > and do a lookup of myself or others + and also search for a group name - it correctly returns that I'm a member of ___-staff group. There's a specific policy I want to exclude for this staff group. I can go to exclusions for this policy > Directory Service User Groups > search for the staff group I'm apart of > it finds it, and I add it. After doing that, I still see my computer as pending like it's still in the scope. User & Location info is accurate, my local account matches LDAP user name, etc. How are people future-proofing scoping? My other option is to hand-build Departments in Jamf that match Departm

Hi,I have recently deployed a new wifi cert for our wifi office network and I am testing it at the moment.Once I choose the network, it will ask me to choose a certificate or enter credentials. I choose the new certificate and then afterwards the “eapolclient” prompt pops up. I click Deny and then I am able to connect to the Wifi with the new cert. I am wondering if there is a way to either always click Deny, or during these network authentications allow it to have permissions to the System keychain. Also if someone has a way to allow users to use our new certificate without even having to choose the new cert themselves, that would be even better. What I am trying to do is to minimize the steps that users have to do to connect to our Wifi with the new certificate. On the configuration policy, I only have the p12 cert and the network part 

Hi! Looking for a way to disable the "Restart and show password reset options" as mentioned in https://support.apple.com/en-us/HT202860 We have firmware passwords set on our laptops (by policy the firmware password is only known to IT) and when a user clicks that, it gets stuck at the firmware password screen. Reboots go right back to the firmware screen. Unfortunately, with all the work from home, we can't just stop by to fix it. 

Hello,Before asking my question, I’d like to briefly describe our current environment:We are using Jamf Pro on-premises. MacBook devices are enrolled using the User-Initiated Enrollment method. During enrollment, a hidden local account named jamf is created on the machine. All devices are domain-joined, and FileVault is enabled. Users log in with their Active Directory (AD) accounts, which are configured as mobile accounts. Initially, we manually create a local admin account named support during setup. This ensures that both the support account and the user’s AD account are enabled for FileVault.Our security team has raised a concern because the support account currently uses the same password across all devices. They have requested that we either remove this account or implement automatic password rotation, similar to a managed account.Could you advise on the best approach? How do you typically handle this scenario?Additionally:Is it possible to add the jamf account to FileVault? Woul

Has anyone had luck getting Accessibility to "allow" or "let standard user approve"?Similar to the post here https://community.jamf.com/t5/jamf-pro/enabling-privacy-accessibility-setting-for-ms-teams/m-p/245576#M230198 we've used the PPPC Utility to "let standard users approve" Screen Recording but does not seem to work for accessibility. We have a handful of apps that needs Accessibility to "allow" or "let standard user approve" for non-admins but cannot get it to work. Apps like MS Teams, Logitech Logi Options will not work for the "Accessibility" section. I've attempted to use the PPPC utility and though the other options work it's "Accessibility" that will just not work.

Hello everyone, We have a strict requirement to allow standard (non-admin) macOS users to enable Internet Sharing, even if this is an Apple platform limitation. Granting local admin rights is not an option. Environment:  macOS (Ventura / Sonoma) Jamf Pro Standard user accounts only   What we’ve reviewed so far:  Jamf policies and scripts Self Service workflows Configuration profiles / PPPC Authorization Database changes   At this point, Internet Sharing appears to require system-level privileges, but the business requirement still stands and we need to explore any supported or semi-supported approach that can meet this need without making users admins. Questions:  Has anyone achieved this using Jamf or macOS controls? Are there any workarounds (MDM-driven, scripted, or AuthorizationDB-based) that allow standard users to enable Internet Sharing? Can Jamf or Apple officially confirm whether this is completely blocked?   Any guidance, confirmation, or alternative approaches

New behaviour in iPadOS 17 - when you only define a lock screen wallpaper and do not define the home screen wallpaper and you do not click the check box to use the same image for lock and home, iPadOS 17 now magically makes home and lock screen identical. (Huh? That's not what I asked for)I filed an Apple Feedback Assistant ticket and they said it is "currently functioning as intended".It didn't do this in 16.So what's the issue? If you make a reasonably great looking lock screen wallpaper it is totally distracting as a home screen wallpaper. The app icons become too cluttered with the background - there's no visual sense of depth to separate. If you use the QR code, it looks terrible on every page.The consequence is that you have to allow changes to wallpaper and you have to choose a plain style home screen. Then if you want your beautiful lock screen to stay "locked" so that students don't remove it you have to play the restrictions dance in both Restrictions and the Wallpaper payloa

Hello, I'm new here, I'm a student I got a school ipad and I was able to download absolutely any app I want. I signed in to an apple account then I use spotlight to find an app : like MailChimp or candy crush and when the result from the app store is showed I can press the get button that will install the app. App store is restricted on the device but using spotlight can bypass this. Maybe I'm not in the right place but just wanted to report this bug. I'm on iPados 26.1

Hi All,  I am trying to remove the phone icon and nothing is working.  This device does not have a SIM card, it uses Wifi only.  I have tried adding it to a Restrictions profile where I am removing all other system apps and it's the only icon that is not being hidden.  I am also applying a Home Screen layout and this icon is not one of the icons I wish to display in that policy.  What am I missing?Appreciate the help! 

Instead of seeing iOS 19 and macOS 16 at WWDC this year on June 9, Apple is planning for iOS 26 and macOS 26. It's a similar name convention for automakers. Like the Toyota Camry 2026.   Other Apple Operating Systems will follow suit.  iOS 26iPadOS 26macOS 26watchOS 26tvOS 26visionOS 26 Thoughts? https://www.macrumors.com/2025/05/29/ios-26-again-rumored/

 When I look back on where I started, joining the Matter Career Readiness Institute (MCRI) was one of the most defining decisions of my tech journey. What began as an opportunity to learn about career readiness quickly became a launchpad into a world of innovation, purpose, and growth. Laying the Foundation: Learning Beyond the CodeAt MCRI, I didn’t just learn how to code, I was taught how to be a better professional and, honestly, a better person. Through communication workshops, critical thinking sessions, and collaborative projects that mirrored real-world work environments, I discovered that being “career ready” in tech isn’t just about what you can build, it’s about how you approach problems, adapt to change (roll with the punches), and connect with others.One of my biggest takeaways from the program was understanding the importance of continuous learning and curiosity, realizing that in technology, the moment you stop evolving, you risk falling behind. From Learning to Building:

HI everyone,I am trying to implement JAMF Connect in our organization. I was able to successfully configure the OIDC, but while testing the ROPG, I am getting the attached error. I have confirmed that the client secret ID is correct, as the ROPG login is working for just one account. Also, all the users have been given access to the Enterprise Application. Any leads would be helpful. Thanks

Do you have a naming convention for Smart Groups and Static Groups in Jamf as well as for iPhones and iPads?

HII apologize in advance if that question was asked but I cannot find answers :( I need to retrieve following information through API: 1. retrieve members through API from static computer groups - i need to list computer names that belong to specific computer groups.  All i'm able to find is how to list computer groups, but not how to retrieve members. # Endpoint to retrieve computer groups$computerGroupsUrl = "$jamfUrl/api/v1/computer-groups"# Request computer groups$responseComputerGroups = Invoke-RestMethod -Uri $computerGroupsUrl -Method Get -Headers $headers -ErrorAction Stop 2. retrieve members through API from smart computer groups - i need to list computer names that belong to specific computer groups 3. retrieve data through API from "reports" found under "Search inventory"